A SOC 1 report is an examination of controls at a service organization that are relevant to the internal control over financial reporting of the organizations that use it. If your service affects how a customer's numbers are produced, a buyer's auditor may ask for SOC 1. A SOC 2 report addresses other criteria.
What the AICPA says
The AICPA describes SOC 1 as an examination of controls at a service organization relevant to user entities' internal control over financial reporting. The reports help client organizations and their auditors evaluate how the provider's controls affect the client's financial statements. SOC 2 is described separately, as reporting on controls related to security, availability, processing integrity, confidentiality or privacy.
The AICPA pages we read did not explain the Type 1 and Type 2 split for SOC 1. Check the AICPA SOC 1 guide for that before you scope an engagement.
A quick test for relevance
Ask: if our service made an error, would a customer's financial statements be wrong? Examples of services where that can be true, in our judgment, include payroll processing, payment handling, billing and revenue calculation, and systems that hold ledgers. A pure developer tool or an analytics dashboard rarely meets the test.
Who asks
The person asking is usually the customer's finance or audit function, not their security team. That is a clue. A security questionnaire from IT usually points to SOC 2 or ISO 27001. A request that mentions financial statement auditors, control objectives or ICFR points to SOC 1.
What to do when asked
- Ask who is requesting it and why. Is it for a financial statement audit?
- Ask which of your services and which control objectives matter to them.
- Check whether your current work, such as a SOC 2, covers part of the same controls. Overlap is common, but it is not the same report.
- Talk to a CPA firm about scope before promising a date.
- Do not describe a SOC 2 report as a SOC 1, or the reverse.
Wording to avoid
SOC reports are attestations from an independent CPA, not certifications. Avoid "SOC 1 certified". Say "we have a SOC 1 report" only when you do, with its period and scope.
Our guide to reading attestation reports applies to SOC 1 as well.
Quick check
Is SOC 1 about security?
Not primarily. It addresses controls relevant to customers' internal control over financial reporting.
Can a SOC 2 report replace SOC 1?
Not automatically. They address different subject matter, so ask the requester what they need.
Sources
Last reviewed: 19 October 2026.
